Privacy Policy

The controller of the personal data described in this policy is Quetzal Tech, S.L. (Sociedad Unipersonal), registered office Alameda Principal, 24, planta 1ª, puerta 3, 29005 Málaga, España, contactable at hello@quetzaltech.es. Full company identification is in the Legal Notice.

We have not appointed a Data Protection Officer, as we are not required to. Data protection questions go to the address above and are handled by the company’s director.

Account data. Your email address, name and authentication details when you create an account.

Connected social accounts. When you connect Instagram, Facebook, LinkedIn, TikTok, X or YouTube, the platforms grant us OAuth access tokens. These tokens are stored encrypted in a dedicated secrets vault, never in plaintext, and are used exclusively to publish the content you approve and to read the performance of your own posts.

Content and performance metrics. The briefs you write, the drafts Quetzal generates, the assets you upload, and the engagement metrics of your published posts (collected at 1, 6, 24 and 72 hours after publishing).

Videos, audio and photos you upload. When you upload footage, recordings or voice for an edit, Quetzal transcribes the speech and AI models analyse the video and its frames (scenes, faces for framing, on-screen text, the strongest moments) so it can cut, frame and caption it. Photos of a real person that you upload to create an avatar are used only inside your workspace to make videos of that person, and you can delete the avatar, with every photo and clip of it, at any time from the avatar studio.

Billing data. If you subscribe to a paid plan, our payment processor collects your payment details directly. We receive and store the subscription status, plan and invoice records, never your full card number.

When you connect an account, we receive from that platform, about that account, only what the permissions you granted allow: the profile identity (account or page name, ID and avatar), the ability to publish content you have approved, and the metrics of your own published posts (impressions, reactions, comments, shares, clicks, follower counts). Where you enable comment or message automation, we also receive the comments and messages sent to your account so the feature can respond. Separately, the Quetzal Engage reply feed reads other people’s public posts on X with Quetzal’s own access, not yours; that is described in its own section below.

We use this data solely to provide the features you turned on, inside your own workspace. We do not use it to build advertising profiles, we do not combine it with data from other customers to identify individuals, and we do not transfer it to any party other than the processors listed below. Our use of information received from Meta APIs follows the Meta Platform Terms and Developer Policies, and equivalent terms apply for every other connected platform.

Disconnecting an account revokes our tokens immediately and stops all further collection. Deleting your workspace erases the data already received, as described under data deletion.

To provide the service: generating drafts in your brand voice, scheduling and publishing what you approve, measuring how it performs. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

To improve your results: your own consented performance metrics inform which content the system proposes to you next. Legal basis: performance of our contract, and your consent where you enable optional data sharing (Art. 6(1)(a) and 6(1)(b) GDPR).

To keep the service secure and working: authentication, abuse prevention, error diagnosis, safety filtering. Legal basis: our legitimate interest in operating a secure service (Art. 6(1)(f) GDPR).

To bill you and meet our obligations: invoicing, tax and accounting records. Legal basis: performance of contract and compliance with a legal obligation (Art. 6(1)(b) and 6(1)(c) GDPR).

External platform data is used as context at drafting time only and is never trained into model weights.

Quetzal uses AI models to draft captions, images and video from your briefs and brand materials. These are content suggestions, not decisions about you: nothing is published without your approval, and no automated processing produces a legal or similarly significant effect on you within the meaning of Art. 22 GDPR. Where the autopilot is enabled, you authorise publication in advance through the settings you control, and you can withdraw that authorisation at any time.

We do not sell your data. We do not share your content or metrics with advertisers. We do not publish anything without your approval or your configured autopilot mandate.

We rely on these processors to run the service. Each receives only the data needed for its function:

• Supabase: database, sign-in, file storage and the encrypted secrets vault. European Union (Paris).
• Vercel: hosting and delivery of the website and the app. Functions run in the European Union (Paris); pages are delivered through Vercel’s global network, and Vercel is a United States company.
• Hetzner: our own servers that render videos, process uploaded footage and run trend research. European Union (Helsinki, Finland).
• Inngest: runs background jobs, which carry the job’s data while it runs. United States.
• Google: Gemini models on Vertex AI (text, and the analysis of images and uploaded video), Google Analytics (see Cookies) and Google Workspace (our email inbox). Vertex AI may process a request in any Google region, including outside the European Union.
• Anthropic: Claude models for writing and checking text. United States.
• OpenRouter and fal: access to AI models for text, images and video, including OpenAI’s image models. United States.
• Runware: access to the image models that paint our images. A United Kingdom company, with servers in the European Union and the United States.
• ElevenLabs and Groq: voice generation and the transcription of uploaded audio and video. United States.
• Zernio: publishing to Instagram, Facebook, TikTok and LinkedIn, and reading their comments and messages, for accounts connected through it. European Union (Spain).
• FxTwitter: a public service we use to read public X posts and profiles. It receives only the id of the public post or account being read. Outside the European Union.
• Jina AI: fetches public web pages, such as a website you ask us to read. It receives only the address of that page. Jina AI GmbH (Germany), part of Elastic.
• Stripe: payments, subscriptions and invoices. European Union and United States.
• Resend: sending our emails. United States.
• PostHog: product analytics (see Cookies). European Union.

Stock and music libraries (Pexels, Pixabay, Jamendo, Freesound) receive search words only, never personal data. The social networks you connect (Meta, X, LinkedIn, TikTok, YouTube) are not our processors: they are the platforms you publish on, and their own privacy policies apply.

Where a provider processes data outside the European Union, the transfer relies on an adequacy decision of the European Commission (as for the United Kingdom) or on its Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework. You can ask for the transfer safeguards in place for any of them at hello@quetzaltech.es.

Access tokens and secrets are encrypted at rest in a dedicated vault, never stored in plaintext and never exposed to the browser. Every workspace is isolated at the database level, so one customer’s data cannot be read from another’s session. Access to production data is limited to what operating the service requires.

Police forces, courts, tax authorities and regulators can ask a company for data about its users. We have a written policy for what happens when they ask us, because a small company is exactly where an improper request is most likely to succeed.

We check that the request is lawful before anything is disclosed. We require a court order, a judicial or prosecutorial order, or a statutory power that names the obligation. We verify the authority through its own published contact channels, check that it has jurisdiction over us in Spain, and check that what is being asked for is actually within the instrument. An informal email or a phone call is not a legal instrument and is answered by asking for one.

We challenge requests we consider unlawful. Where a request is overbroad, improperly served, outside the authority’s jurisdiction or unsupported by any instrument, we ask for it to be narrowed, we refuse the parts not covered, and we oppose it through the available legal remedies with counsel. We do not disclose while a challenge is pending unless a court orders us to.

We disclose the minimum. Never a database, a workspace or an account when specific records were asked for: only the named fields, for the named person, for the named period. Message and comment content is disclosed only where the instrument explicitly reaches it. Access tokens and credentials are never disclosed to anyone.

We document every request, including the ones we refuse and the ones where nothing is handed over, recording the authority, the instrument, our review and reasoning, any challenge and its result, and exactly what was disclosed. These records are kept for six years.

Where we are legally permitted to, we tell you that your data was requested and what was given. Where the request reaches data we obtained from a connected platform such as Meta, we notify that platform and direct the authority to it, since that is where the data came from. The only exception to this whole process is an imminent risk of death or serious physical harm, where we may disclose the minimum necessary immediately and document it the same day.

As of 15 September 2026 we have never received a request of any kind, from any authority, in any country, for the personal data of any user. That includes national security requests. We update this page when that changes.

You can request access to the personal data we hold about you, ask for it to be rectified or erased, obtain a portable copy, restrict or object to processing, and withdraw any consent you have given. Withdrawal does not affect processing already carried out. Email hello@quetzaltech.es and we will respond within 30 days.

You can also delete your data yourself at any time; see data deletion. If you believe we have handled your data improperly you may lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (aepd.es), or with the authority of your own country of residence.

We keep your data for as long as your account is active. When the owner deletes a workspace in Settings, its posts, connections, brand materials, uploaded and generated files, analytics, Engage feeds, comments and messages are deleted, its subscription is cancelled and its connection tokens are destroyed. Encrypted tokens for disconnected accounts are deleted at disconnection time. A few records are kept on purpose: invoicing and tax records for the period Spanish law requires, currently six years; usage and cost records, without the link to the deleted workspace; and the shared public research libraries described in the Engage section below. Deleting a workspace does not delete your sign-in account (your email and name): to have it erased, write to hello@quetzaltech.es and we delete it within 30 days.

Quetzal is a business product and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, write to us and we will remove it.

If your plan includes Engage and you set up a reply feed, Quetzal reads public posts on X that match the feed you defined (words, a public X list, or your sector) through X’s official API or the public FxTwitter service, using Quetzal’s own access, never yours. For each post it stores the post’s text, id, time and public counts (likes, replies, reposts, bookmarks, views), and the author’s public profile fields: name, handle, bio, avatar, verification badge and follower count. From these it ranks which posts are worth replying to and suggests accounts worth talking to. To sort the posts and draft replies, the post text is processed by our AI model providers, listed under Processors and international transfers. The people who wrote those posts are not Quetzal users, and this paragraph is how we tell them.

Purpose and legal basis. The only purpose is to show you, inside your own workspace, public conversations you may want to join, and to help you draft a reply you then send yourself. The legal basis is our and our customers’ legitimate interest in taking part in public conversations on X (Art. 6(1)(f) GDPR), limited to information the author already made public on X. We never contact anyone automatically: nothing is posted, liked, followed or sent to the author by Quetzal, every reply is written by a person who presses X’s own Reply button, and the data is never sold, used for advertising, or shared with other customers.

Retention. The posts and profile fields a feed shows are kept in the workspace that read them for as long as that workspace exists, and are deleted with it. Accounts a customer hides are kept as an id and handle, so they stay hidden.

Shared research libraries. Separately, and not inside any workspace, Quetzal keeps public data it uses for trend research for all customers: the public X profile and recent public posts of accounts Engage has looked at, and which public accounts follow which (to suggest people to talk to); and public posts with their public counts in our viral, competitor and sector libraries, from X, LinkedIn, Instagram, TikTok, YouTube and Facebook. They hold only what the account already made public, they are used only as research and writing context, and they are not deleted when a customer deletes a workspace. When a post is removed from its network, we keep only its ids and delete its text and author details.

If you are the author of a post or the owner of an account and want it removed, or want to object to this processing, write to hello@quetzaltech.es with your handle and we will remove it from every workspace and from these libraries within 30 days.

Quetzal Engage is an optional Chrome extension. What it reads depends on where you are. On x.com, it reads the one post you are replying to (its text, id, author, reply count, view count and time), and only when you press its Draft button on that composer. On any other site, it reads only the text you select and send through the right-click menu. It never reads your feed, never reads your cookies or your X session, and it cannot see any page it has no button or menu entry on.

It sends to quetzaltech.app, over an encrypted connection, only what drafting needs: that text; on X, the post id, its author’s handle, and the reply count, view count and time shown on that post (for its reply score); any angle or thoughts you type for the draft and the tone you pick; and the role you type to say who is replying. Quetzal uses it to generate draft replies in your brand voice and to score whether the post is worth a reply. It stores a single connection token in the browser, which you can revoke at any time from Settings, Extension, or by pressing Disconnect in the extension itself; revoking it stops the extension from reaching Quetzal at all.

It never posts, likes, follows or comments for you. Every draft it writes is placed for you to read, edit and send yourself: on X it fills the reply box you already have open, and on other sites it shows the draft in its own panel for you to copy and paste. The extension may also show you suggestions, such as posts or accounts, that Quetzal already found on its own servers for your workspace; showing a suggestion is not an action taken on your behalf, and nothing is sent or posted without you pressing the platform’s own button.

Uninstalling the extension, or revoking its connection token, removes its access immediately: it stops reading and sending anything further. The text you send it and the drafts it writes from that text are stored as ordinary workspace content, the same as anything drafted inside Quetzal itself: they are kept in your workspace and count toward your account’s monthly drafts. They are kept for as long as your account is active and are deleted with it, as described under Retention. Drafting itself is carried out by the AI model providers listed above under Processors and international transfers.

Strictly necessary cookies keep the product working and are always on: a session cookie that keeps you signed in, plus q-lang (your language preference) and q-theme (light or dark mode). These don’t require consent.

Analytics cookies are optional and off by default. Until you opt in, our two analytics tools, PostHog and Google Analytics, run in a cookieless mode: they count anonymous visits without storing anything on your device and without identifying you. If you accept, they set their own cookies (ph_* and _ga*) so we can see how a visit unfolds across pages; you can withdraw at any time and they stop again. We use no advertising cookies at all. Your choice is stored in a q-consent cookie; change it anytime via “Cookie settings” in the footer.

When we change this policy we update the date at the top. If a change materially affects how we handle your data, we tell you in the product or by email before it takes effect.

Questions about this policy: hello@quetzaltech.es.